SafeSpeak (Project Spire)

Product and operator

SafeSpeak at safespeak.eu is operated by Project Spire OÜ, an Estonian company entered in the business register on 25 July 2025. This listing concerns that product, not the SafeSpeak feature within PeopleForce Desk. A named customer reference or live customer whistleblowing channel was not verified during this review.

The vendor describes anonymous reporting, attachments, two-way messaging, case management, deadline reminders and three user roles. It advertises 36 languages, including all 24 official EU languages. These are public claims; neither a reporter submission nor a handler session has been tested.

Pricing and contract

The monthly plan is €24. Annual payment is €244.80 in advance, equivalent to €20.40 per month. Applicable VAT is additional. The 30-day trial does not require a payment card. Paid subscriptions renew automatically, and cancellation ends the subscription at the end of the current paid period.

The terms describe printable case reports, case-list CSV downloads and a full-organisation export. They provide no service-level agreement. Export availability after a subscription ends is documented as 90 days.

Security and retention limits

The DPA names Germany for report storage and Ireland for transactional email. Its transfer provisions and the privacy policy allow some access from outside the EU; the homepage’s broader EU-only wording should be read with those qualifications. Likewise, the privacy policy allows short-lived hosting-provider logs that may contain IP addresses, while stating that SafeSpeak itself does not store them.

Encryption at rest and in transit is documented; end-to-end encryption is not claimed here. The DPA says built-in MFA is not yet available for email/password accounts. External identity providers may enforce their own MFA. No current vendor ISO 27001 certificate was verified.

Retention can be set from 12 months to seven years after closure, or indefinitely, but the DPA explicitly leaves deletion to administrators. It does not describe an automatic purge. The homepage’s 90-day reminder wording also needs product testing against the three-month feedback period described in the DPA.

Scoring review — 2026-10-25

Scored under the 25-criterion rubric at access tier P. Published pricing, named storage locations and the subprocessor objection process support the score. Workflow, permissions, exports and language completeness still need testing. Zeroes for unverified behavior are evidence gaps, not findings that the product lacks those features.